Asymmetric Cryptography

In this guided exercise, you will apply what you have learned to create an asymmetric encryption key pair. You will then retrieve the public key for a second user to send them a message. Finally, you will assume the role of the second user and use your private key to decrypt the first user’s message. For the purposes of this exercise, the first user is named cybrary and the second user is named sally.

1. On the dock at the bottom of the screen, click the Terminal Emulator icon to open a Terminal window.
   In the next step, you will use OpenSSL’s genpkey subcommand to generate a private key. The syntax to create a new private key is:
   
   openssl genpkey -algorithm rsa -out [private].key
   
2. At the cybrary@localhost prompt, type openssl genpkey -algorithm rsa -out cybraryprivate.key and press Enter to create a new private key.
   

   

   You will never share this key with anyone.
   
3. At the cybrary@localhost prompt, type cat cybraryprivate.key and press Enter to display your private key.
   

   

   
   In the next issue, you will use OpenSSL's rsa subcommand to derive a public key from the private key. The syntax to create a new public key is:
   
   openssl rsa -pubout -in [private].key -out [public].key
   
4. At the cybrary@localhost prompt, type openssl rsa -pubout -in cybraryprivate.key -out cybrarypublic.key and press Enter to create a new public key based on your private key.
   

   

   Public keys are safe to share with anyone. A simple web server is used as a public key server in our lab.
   
5. On the dock at the bottom of the screen, click the Web Browser icon to open a browser window.
   
   Note: It can take up to 30 seconds for the browser to open for the first time.  There is no need to click on the browser icon more than once.
   
6. In the browser window, click on the keyserver bookmark.
   

   

   Notice that both John and Sally have published their public keys. Anyone can download a public key to create encrypted content for John or Sally.
   
7. In the terminal window, type sudo cp cybrarypublic.key /var/www/html and press Enter to copy the public key to the /var/www/html directory.
   
   In a production key-sharing system, you would likely have a web-based tool to manage sharing public keys, but the copy command will do for our purposes.
   
8. In the web browser, refresh the keyserver page.
   

   

   You will see Cybrary’s public key has been added to the keyserver. Now that we can access public keys, let's send Sally an encrypted message.
   
9. In the browser window, click the sallypublic.key to download it.
   
10. In the terminal window, type echo "Sally, I have an ice cream cake at home for John's surprise birthday party!" > message.txt and press Enter.
    
    In the next step, you will use OpenSSL's pkeyutl subcommand to encrypt and decrypt messages. The syntax to encrypt a message is:
    
    openssl pkeyutl -encrypt -inkey [public].key -pubin -in [filename].txt -out [filename].enc
    
    -inkey = the cipher key to use-pubin = designates you are using a public key
    -in = the message to encrypt, can be anything (text is just an example)
    -out = the name of the encrypted file
    
    The syntax to decrypt a message is:
    
    openssl pkeyutl -decrypt -inkey [private].key -in [filename].enc -out [filename].txt
11. At the cybrary@localhost prompt, type openssl pkeyutl -encrypt -inkey Downloads/sallypublic.key -pubin -in message.txt -out message.enc and press Enter to encrypt your message to Sally.
    

    

12. At the cybrary@localhost prompt, type base64 message.enc > message.base64 to encode the encrypted message for sending.
    
13. At the cybrary@localhost prompt, type cat message.base64 | mail -s "For Sally" sally and press Enter to mail Sally the encrypted (and base64 encoded) message.
    
14. At the cybrary@localhostprompt, su - sally and press Enter to become user sally.
    
    When prompted for the password, type password and press Enter.
    

    

    Notice that the prompt changes, indicating you are now the sally user.
    
15. At the sally@localhost prompt, type mail and press Enter.
    

    

    You should see a new message from Cybrary.
    
16. At the ? prompt, type 1 and press Enter to read the message.
    

    

17. Highlight the message body (only the message body), then right-click and select Copy from the context menu.
    

    

18. At the ? prompt, type exit and press Enter to close the mail application.
    
19. At the sally@localhost prompt, type echo " and paste the copied message contents, then continue typing " > message.base64 and press Enter.
    

    

20. At the sally@localhost prompt, type base64 -d message.base64 > message.enc to decode (but not decrypt) the message.
    
21. At the sally@localhost prompt, type openssl pkeyutl -decrypt -inkey sallyprivate.key -in message.enc -out message.txt and press Enter to decrypt the message.
    
22. At the sally@localhost prompt, type cat message.txt and press Enter to read the decrypted message from Cybrary.
    
    You can also just read the encrypted message directly if you like by typing openssl pkeyutl -decrypt -inkey sallyprivate.key -in message.enc and pressing Enter.